IT Security Specialist

The Step2 Company, LLC•Streetsboro, OH

7d•Hybrid

About The Position

Step2 is seeking a security leader who combines strategic thinking with hands-on technical expertise. The IT Security Specialist owns the security program end to end, including strategy, tools, vendors, training, and incident response. The role focuses on protecting users, systems, data, and sites against changing threats, particularly attacks and vulnerabilities associated with AI. It requires evaluating modern security approaches rather than simply reimplementing a familiar legacy stack. The specialist develops security strategy and business continuity plans; sets controls for employee and system use of AI; leads incident response and risk management; verifies security configurations across Microsoft 365, Entra ID, endpoints, networks, and plant environments; and builds resilient device and data recovery practices. The role also enables secure software development, manages security vendors and telemetry, assesses third-party risk, supports policies and audits, runs employee security awareness activities, and oversees physical site security. The Senior Manager, IT Infrastructure & Operations administers relevant platforms, while this role defines and verifies the security controls. This is a hybrid position based in Streetsboro, Ohio, working across office, plant, and warehouse environments. Travel between Step2 sites is required for physical security needs and incidents. Hours are standard business hours, with flexibility to be reasonably available and respond quickly to critical outages or incidents that stop operations, especially during peak selling seasons.

Requirements

At least 7 years of IT security experience with both strategic and hands-on technical responsibility.
Demonstrated ability to adapt defenses to new threats and evaluate modern and AI-driven security tools on their merits.
Proven initiative in building or substantially improving a security program.
Current knowledge of AI-related threats and controls, with an ongoing practice of keeping up with the threat landscape.
Deep hands-on skill with Microsoft 365 security, Entra ID, EDR, SIEM or log tools, vulnerability scanning, firewalls, and VPN.
Comprehensive experience with security-focused endpoint strategy and management, such as Microsoft Intune and Defender for Endpoint, including remote scanning, device and software inventory, threat and malware detection and removal, and remote isolation and wiping.
Experience running an internal or outsourced SOC, including setting escalation rules and SLAs and conducting performance reviews.
Experience selecting and managing security vendors.
Experience writing and executing incident response plans and tabletop exercises.
Experience building and testing business continuity and ransomware recovery plans.
Experience running a security awareness program such as KnowBe4.
Working knowledge of a security framework such as NIST CSF or CIS Controls.
Clear communication skills, including explaining risk to leadership and training non-technical staff.

Nice To Haves

Certifications such as CISSP, CISM, Security+, CySA+, or Microsoft SC-200/SC-300.
Experience securing manufacturing or OT/plant networks.
SQL and scripting skills in PowerShell or Python for automating checks and analyzing telemetry; Snowflake or Grafana experience.
Experience with Oracle E-Business Suite or Snowflake access controls.
Experience with AI security frameworks such as OWASP Top 10 for LLM Applications or NIST AI RMF.

Responsibilities

Track emerging threats, including AI-enabled phishing, deepfakes, social engineering, prompt injection, AI-related data leakage, and vulnerabilities in AI agents and integrations; translate findings into security and business continuity strategy, a current tactical roadmap, and leadership risk briefings.
Set guardrails for employee and system use of AI tools, agents, and MCP connections, and review AI tools and vendors for data exposure and access risks.
Own incident response plans, playbooks, and courses of action; run tabletop exercises, lead incident response, and maintain a risk register with mitigation plans.
Build and test business continuity and recovery plans, including fast device rebuilds, Microsoft 365 and OneDrive recovery, versioning, retention, backup, and regular recovery drills.
Define and verify security controls for MFA, conditional access, and privileged accounts in Entra ID; Microsoft 365; vulnerability management; firewalls, VPNs, network segmentation including plant networks; and employee and contractor access reviews.
Own employee laptop and mobile device security strategy, including remote scans, live device and software inventory, threat and unapproved-software detection, malware removal, and remote isolation or wiping of compromised devices.
Work with software developers to design and enable CI/CD security testing, including SAST, DAST, dependency scanning, and secrets scanning; address vulnerability classes such as OWASP Top 10 and CWE Top 25 and help developers remediate findings.
Select, implement, and manage security vendors and monitoring tools such as EDR, SIEM/MDR, email security, and vulnerability scanning; manage contracts, performance, and budget.
Consolidate security telemetry and logs into Snowflake and build dashboards and alerting, such as in Grafana, to report risk, trends, and program performance.
Evaluate vendors against security compliance thresholds before and after onboarding; set appropriate least-privilege, time-limited, and MFA-protected access; and reassess vendors regularly.
Maintain current security policies and standards and support audits, cyber insurance requirements, and customer or retailer security questionnaires.
Run the KnowBe4 employee training and phishing simulation program, measure results, tailor content to actual threats and roles, and recommend program improvements.
Oversee building access control, badges, door systems, visitor access, security monitoring, and CCTV across Step2 sites; manage systems and vendors, review access rights, and integrate physical security events into incident response and telemetry.